docs: def validate_oath_totp(self, params):
      """
      Validate OATH-TOTP code using YubiHSM HMAC-SHA1 hashing with token keys
      secured in AEAD's that we have stored in an SQLite3 database.
      """
      from_key = params["totp"][0]
      if not re.match(totp_valid_input, from_key):
          self.log_error("IN: %s, Invalid OATH-TOTP OTP" % (params))
          return "ERR Invalid OATH-TOTP OTP"
      uid, otp, = get_oath_totp_bits(params)
      if not uid or not otp:
          self.log_error("IN: %s, could not get UID/OTP ('%s'/'%s')" % (params, uid, otp))
          return "ERR Invalid OATH-TOTP input"
      if args.debug:
          print "OATH-TOTP uid %s, OTP %s" % (uid, otp)
  
      # Fetch counter value for `uid' from database
      try:
          db = ValOathDb(args.db_file)
          entry = db.get(uid)
      except Exception, e:
          self.log_error("IN: %s, database error : '%s'" % (params, e))
          return "ERR Internal error"
  
      # Check for correct OATH-TOTP OTP
      nonce = entry.data["nonce"].decode('hex')
      aead = entry.data["aead"].decode('hex')
      new_timecounter = pyhsm.oath_totp.search_for_oath_code(
          hsm, entry.data["key_handle"], nonce, aead, otp, args.interval, args.tolerance)
  
      if args.debug:
          print "OATH-TOTP counter: %i, interval: %i -> new timecounter == %s" \
               % (entry.data["oath_c"], args.interval, new_timecounter)
      if type(new_timecounter) != int:
          return "ERR Could not validate OATH-TOTP OTP"
      try:
          # Must successfully store new_timecounter before we return OK
          # Can use existing hotp function since it would be identical
          if db.update_oath_hotp_c(entry, new_timecounter):
              return "OK timecounter=%04x" % (new_timecounter)
          else:
              return "ERR replayed OATH-TOTP"
      except Exception, e:
          self.log_error("IN: %s, database error updating counter : %s" % (params, e))
          return "ERR Internal error"